# Google Android.

Every CVE that names Google Android among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [Buffer overflow in Google Android](https://agentprime.io/advisories/CVE-2026-58977.md)
  `CVE-2026-58977` · CVE record: Google Android · CVSS 6.7 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [An unprivileged application can exploit a lack of package/signature validation in SystemUI's \`RemoteQCController\` when resolving a hardcoded \`content://\` URI.](https://agentprime.io/advisories/CVE-2026-58930.md)
  `CVE-2026-58930` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized \`std::weak_ptr\` within \`EvsEnumerator::openCamera()\`.](https://agentprime.io/advisories/CVE-2026-58927.md)
  `CVE-2026-58927` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [Use after free in Google Android](https://agentprime.io/advisories/CVE-2026-58926.md)
  `CVE-2026-58926` · CVE record: Google Android · CVSS 2.5 Low · Not analysed yet · Published 2 Nov 2026 · Tags: Race condition, Memory corruption
- [Google Android: The report details a heap Use-After-Free (UAF) vulnerability within the…](https://agentprime.io/advisories/CVE-2026-58925.md)
  `CVE-2026-58925` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [The vulnerability is a heap out-of-bounds read in the EVS HAL's \`getStreamList()\` method.](https://agentprime.io/advisories/CVE-2026-58924.md)
  `CVE-2026-58924` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [Improper authentication in Google Android](https://agentprime.io/advisories/CVE-2026-58915.md)
  `CVE-2026-58915` · CVE record: Google Android · CVSS 6.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Authentication bypass
- [Google Android: An unprivileged application can bypass the…](https://agentprime.io/advisories/CVE-2026-49906.md)
  `CVE-2026-49906` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [Google Android: The \`ClusterRenderingService.dump()\` method…](https://agentprime.io/advisories/CVE-2026-49903.md)
  `CVE-2026-49903` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check.](https://agentprime.io/advisories/CVE-2026-59048.md)
  `CVE-2026-59048` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-59047.md)
  `CVE-2026-59047` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-59046.md)
  `CVE-2026-59046` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Race condition in Google Android](https://agentprime.io/advisories/CVE-2026-59045.md)
  `CVE-2026-59045` · CVE record: Google Android · CVSS 7.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Race condition
- [Use after free in Google Android](https://agentprime.io/advisories/CVE-2026-59044.md)
  `CVE-2026-59044` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [Race condition in Google Android](https://agentprime.io/advisories/CVE-2026-59043.md)
  `CVE-2026-59043` · CVE record: Google Android · CVSS 7.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Race condition
- [Race condition in Google Android](https://agentprime.io/advisories/CVE-2026-59042.md)
  `CVE-2026-59042` · CVE record: Google Android · CVSS 7.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Race condition
- [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2026-59031.md)
  `CVE-2026-59031` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-693
- [In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-59028.md)
  `CVE-2026-59028` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code.](https://agentprime.io/advisories/CVE-2026-59022.md)
  `CVE-2026-59022` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-59021.md)
  `CVE-2026-59021` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Race condition in Google Android](https://agentprime.io/advisories/CVE-2026-59020.md)
  `CVE-2026-59020` · CVE record: Google Android · CVSS 5.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Race condition
- [Path traversal in Google Android](https://agentprime.io/advisories/CVE-2026-59016.md)
  `CVE-2026-59016` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Path traversal
- [In multiple locations, there is a possible permission bypass due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-59015.md)
  `CVE-2026-59015` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [Out-of-bounds write in Google Android](https://agentprime.io/advisories/CVE-2026-59014.md)
  `CVE-2026-59014` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a missing permission check.](https://agentprime.io/advisories/CVE-2026-59012.md)
  `CVE-2026-59012` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [In multiple locations, there is a possible permission bypass due to a logic error in the code.](https://agentprime.io/advisories/CVE-2026-59011.md)
  `CVE-2026-59011` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [Buffer overflow in Google Android](https://agentprime.io/advisories/CVE-2026-59010.md)
  `CVE-2026-59010` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-59008.md)
  `CVE-2026-59008` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Out-of-bounds read in Google Android](https://agentprime.io/advisories/CVE-2026-59007.md)
  `CVE-2026-59007` · CVE record: Google Android · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack.](https://agentprime.io/advisories/CVE-2026-59006.md)
  `CVE-2026-59006` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-451
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-59005.md)
  `CVE-2026-59005` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [In multiple locations, there is a possible permission bypass due to an uncaught exception.](https://agentprime.io/advisories/CVE-2026-59004.md)
  `CVE-2026-59004` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-248
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-59003.md)
  `CVE-2026-59003` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [In handleMessage of UsbDeviceManager.java, there is a possible lock-screen bypass due to a logic error in the code.](https://agentprime.io/advisories/CVE-2026-59002.md)
  `CVE-2026-59002` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the code.](https://agentprime.io/advisories/CVE-2026-59001.md)
  `CVE-2026-59001` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [In multiple locations, there is a possible permission bypass due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-59000.md)
  `CVE-2026-59000` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In validateImageInfo of Bitmap.cpp, there is a possible out-of-bounds read due to a precondition check failure.](https://agentprime.io/advisories/CVE-2026-58997.md)
  `CVE-2026-58997` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [Heap-based buffer overflow in Google Android](https://agentprime.io/advisories/CVE-2026-58995.md)
  `CVE-2026-58995` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-58994.md)
  `CVE-2026-58994` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [In l2c_fcr_process_peer_cfg_req of l2c_fcr.cc, there is a possible memory safety issue due to an integer overflow.](https://agentprime.io/advisories/CVE-2026-58990.md)
  `CVE-2026-58990` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-58989.md)
  `CVE-2026-58989` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Buffer overflow in Google Android](https://agentprime.io/advisories/CVE-2026-58988.md)
  `CVE-2026-58988` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-58986.md)
  `CVE-2026-58986` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-58985.md)
  `CVE-2026-58985` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [Use after free in Google Android](https://agentprime.io/advisories/CVE-2026-58984.md)
  `CVE-2026-58984` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2026-58979.md)
  `CVE-2026-58979` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-693
- [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2026-58978.md)
  `CVE-2026-58978` · CVE record: Google Android · CVSS 6.8 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-693
- [In getSelectionBySubIds of ProviderUtil.java, there is a possible cross-user data leak due to a logic error in the code.](https://agentprime.io/advisories/CVE-2026-58976.md)
  `CVE-2026-58976` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [Buffer overflow in Google Android](https://agentprime.io/advisories/CVE-2026-58975.md)
  `CVE-2026-58975` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2026-58974.md)
  `CVE-2026-58974` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Privilege escalation
- [In \_mupdf_get_hdr of wprint_mupdf.c, there is a possible out-of-bounds read due to an integer overflow.](https://agentprime.io/advisories/CVE-2026-58971.md)
  `CVE-2026-58971` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-58970.md)
  `CVE-2026-58970` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [In multiple functions of MediaQualityService.java, there is a possible permission bypass due to a missing permission check.](https://agentprime.io/advisories/CVE-2026-58969.md)
  `CVE-2026-58969` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [Double free in Google Android](https://agentprime.io/advisories/CVE-2026-58968.md)
  `CVE-2026-58968` · CVE record: Google Android · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [Stack-based buffer overflow in Google Android](https://agentprime.io/advisories/CVE-2026-58966.md)
  `CVE-2026-58966` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Memory corruption
- [In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy.](https://agentprime.io/advisories/CVE-2026-58965.md)
  `CVE-2026-58965` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-441
- [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2026-58964.md)
  `CVE-2026-58964` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-20
- [In multiple locations, there is a possible denial of service due to improper input validation.](https://agentprime.io/advisories/CVE-2026-58963.md)
  `CVE-2026-58963` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 2 Nov 2026
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2026-58962.md)
  `CVE-2026-58962` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Privilege escalation
- [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2026-58961.md)
  `CVE-2026-58961` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: CWE-693

Older: <https://agentprime.io/advisories/technology/google-android.md?cursor=WyIyMDI2LTExLTAyVDE5OjU0OjI0LjA3NzAwMFoiLCJDVkUtMjAyNi01ODk2MSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=google-android>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/google-android/>. Everything for agents: <https://agentprime.io/llms.txt>.